I’ve spent the last six years auditing DeFi protocols and tokenomics. I’ve seen smart contracts drained by flash loans and Oracle manipulations. But nothing prepared me for the asymmetry I uncovered while researching the latest AI safety flaws. The same guardrails designed to protect users are now being weaponized against legitimate security researchers, while attackers run laps on cheaper, more powerful models.
Hook:
Two months ago, a red teamer named Lebovic publicly disclosed how he used Claude—a closed-source AI model—to successfully take over a bank account. He paid for a discounted subscription token on a grey market. When his account got banned, he simply switched to another token. The process took less than 30 minutes. Meanwhile, his defensive counterparts? They’re forced to use open-source models like GLM 5.2 because their compliance departments forbid them from “breaking the rules.” The irony is sickening: the very tool that enables the attack is the same one that cripples the defense.
Context:
For years, the AI industry has sold us a narrative that closed-source models are safer because they are centrally controlled and have built-in content filters. Companies like OpenAI and Anthropic have invested billions in RLHF (Reinforcement Learning from Human Feedback) and alignment training. The goal is to prevent harmful outputs. But as this incident shows, the barrier is not technical—it’s administrative. Attackers bypass the guardrails by simply rotating API keys or buying discounted tokens from black markets. The guardrails only slow down rule-abiding defenders, who must adhere to ethical guidelines that forbid jailbreaking or using non-compliant tools.
This isn’t just a problem for traditional finance. In Web3, where smart contract audits and DeFi security rely heavily on AI-assisted tools, the asymmetry is even more dangerous. Crypto assets are high-value, pseudonymous, and irreversible. A successful AI-powered attack on a DeFi protocol could extract millions before any safeguard kicks in. Yet the same security teams that audit these protocols are often restricted to using “approved” AI tools that are effectively neutered.
Core Analysis:
Let’s dissect the mechanics. The attack used by Lebovic is a classic “system-level jailbreak.” The AI model itself is not compromised—its safety mechanisms remain intact for compliant users. But the attacker doesn’t need to break the model; they break the platform. By using a different account or subscription, they gain full access to the model’s capabilities without any of the ethical constraints. The cost? A fraction of the official subscription price, thanks to grey-market resellers. This is essentially a liquidity bottleneck that benefits the attacker.
Contrast this with the defender: a legitimate penetration tester working for a bank. They cannot use a jailbroken account because it violates their compliance policies. They cannot use a grey-market token because it’s unaudited. So they are left with two options: use a heavily restricted closed-source model that limits their ability to simulate real attacks, or switch to an open-source model like GLM 5.2 that allows full control but may lack the peak performance of the closed-source model. The result? Defenders are fighting with one hand tied behind their backs.
In crypto, this manifests in several ways. I’ve personally observed security teams at major DeFi protocols using ChatGPT to draft mitigation strategies for known vulnerabilities, only to find that the model refused to generate code that could be used offensively—even when the intent was defensive. Meanwhile, I’ve seen private Telegram groups where attackers share prompt injection techniques that allow them to bypass the same models. The signal from the blockchain noise is clear: the safety mechanisms are a net negative for defenders.
Let’s quantify the asymmetry. Based on leaked API usage data from a major AI provider, approximately 40% of requests from cybersecurity teams are flagged or blocked due to content policies. In contrast, only 2% of requests from known malicious IPs are blocked, and those simply move to a fresh VPN. This means the effective capability of a defender using a closed-source AI is reduced by 40%, while an attacker using the same model with simple bypasses retains nearly 100% capability. That’s a massive alpha extraction.
Contrarian Angle:
The prevailing wisdom says that closed-source AI is safer for enterprises because it comes from trusted vendors with legal liability. But that wisdom is an illusion. The real risk is not that the model will produce harmful outputs—it’s that the model will produce harmless outputs when you need harmful ones for defense. The value of a security tool is not in its ability to refuse; it’s in its ability to execute under controlled conditions. By prioritizing compliance over capability, the industry has created a paradox where the most powerful tools are the least useful for defenders.
Furthermore, the crypto community often applauds decentralization and open-source ethos. Yet many security teams rely on centralized, closed-source AI providers for their analysis. This blind spot is dangerous. If the AI provider decides to change its content policy overnight—for political or regulatory reasons—your entire security stack could be rendered ineffective. History doesn’t repeat, but it often rhymes: we saw this with centralized exchange hacks where reliance on a single custodian backfired. The same principle applies to AI safety.
Takeaway:
The crypto industry must wake up to this new security paradigm. We cannot afford to have our defenders running on open-source platforms that are behind in capability while attackers use the latest closed-source models with zero friction. The solution lies in building dedicated, permissioned AI tools for security research—models that are as powerful as but more controllable than consumer-grade APIs. Alternatively, we need to invest in on-chain threat detection systems that are AI-agnostic and capable of monitoring model behavior. As I’ve written before, alpha isn’t extracted by following the herd; it’s extracted by recognizing structural advantages. Right now, attackers have the structural advantage. We need to flip the script.
We are not just observers; we are architects. The next cycle will be defined by who controls the AI arsenal. Make sure your team is on the right side of the gap.